Live data from Hacker News

Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

csoonline.com

71–80 of 404 posts

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#71
When I try to access sharepoint files in my browser, the site goes through 37 redirects (thanks single sign on) shows all the files, then despite me very obviously being fully authenticated, it pops up a modal that says "sign in to see files", and I click "Cancel" and then I get to actually interact with the files.

What?

Gee, who would have guessed this isn't secure.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#72

Sharepoint is one of the worst, most bug-ridden softwares I've worked with. It has a bug with Solidworks (3D design suite) that sporadically makes files completely un-openable unless you go in and change some metadata. They are aware of this, doesn't seem to be any limitation preventing them from fixing it, and it has sat unfixed for years. Microsoft's cloud storage as a whole is an insane tangle where you never know…

Every time I need to touch anything made my Microsoft lately I am met with multiple levels of glitchyness, straight up bugs, most frustratingly it’s so excruciatingly slow. Recently I tried to configure a new subdomain to handle mail on 365 and even finding their DKIM configuration section was a mission. Once finding it, I learned that their DNS check fails to properly handle subdomains for email, so you have to put…

But wait! 35% of Microsoft's code is now written by AI so surely it will get better

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#74

Sharepoint is one of the worst, most bug-ridden softwares I've worked with. It has a bug with Solidworks (3D design suite) that sporadically makes files completely un-openable unless you go in and change some metadata. They are aware of this, doesn't seem to be any limitation preventing them from fixing it, and it has sat unfixed for years. Microsoft's cloud storage as a whole is an insane tangle where you never know…

They've managed to mess up sharepoint even worse lately.

I went there to try to find where company meetings got recorded to.

I went to my sharepoint bookmark, which weirdly is www.office.com after some previous nightmare rebrand.

Except what used to be the way into your sharepoint files, is now just a full page copilot screen with no hint of where the fuck your files are.

Even though you've been visiting this bookmark for years, to get to your sharepoint files.

Ok, so you search bing sign into sharepoint.

Top result is office.com . You ignore it.

Next result is:

https://support.microsoft.com/en-gb/office/sign-in-to-sharep...

This links you to https://m365.cloud.microsoft/

Ok great. Nope! Redirects you back to copilot.

I do NOT want to ask copilot to dig out my files every time you want a file. I want to get back to the directory listing so I can find the directory listing to find the company meeting recording.

How does MS not understand that replacing all UX with copilot is not an improvement, and is not helping sell copilot.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#75
As usual with all these types of posts, people go "HA HA, MICRO$OFT SUCKS" without understanding business practices that keep them afloat.

Don't use Exchange? Cool, what should we use instead? Does it support 15 people all the way up to 150000 people? I used to run Exchange cluster for 70k people, is there other mail software out there complete with non-shared disk redundancy? Where the users connect to single endpoint and software figures it out from there?

Sharepoint with another 2 RCEs. Not shocked, the software is terrible. However, it's only software that will stand up under load and let us shard it easily. All open-source software is one of those, runs fine in Homelab, likely falls down under load. Few Open Source Developers want to work on this stuff which I get because it's tedious work interfacing with computer illiterate end users. I'd rather chug sewage then do this work for free.

Finally, it's somewhat backwards compatible. Most businesses are filled with ancient software that no one has worked on in 20 years. That Excel document with Macros from 1997. With some registry changes degrading security posture, still works. I doubt you will find Office software with level of backwards compatibility unless they are using Microsoft Office level of compatibility.

Microsoft has real gordian knot here and few solutions besides "Backwards compatibility is OVER. Upgrade to modern or GTFO". Meanwhile, I get hit up by $ThreeJobsAgo over some Exchange Web Services solution I slapped together for them in Python they wanted me to upgrade to GraphAPI since Microsoft turned off Exchange Web Services in Office365.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#76
post #43

Sharepoint is one of the worst, most bug-ridden softwares I've worked with. It has a bug with Solidworks (3D design suite) that sporadically makes files completely un-openable unless you go in and change some metadata. They are aware of this, doesn't seem to be any limitation preventing them from fixing it, and it has sat unfixed for years. Microsoft's cloud storage as a whole is an insane tangle where you never know…

We sync content to MS hosted Sharepoint using rsync. When the file arrives, they change the internal metadata inside the file, which changes the checksum, which causes rsync to think the content is different and needs syncing again. Edit to say: this is for MS files like Excel docs

Is that a supported method?

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#77

Sharepoint is one of the worst, most bug-ridden softwares I've worked with. It has a bug with Solidworks (3D design suite) that sporadically makes files completely un-openable unless you go in and change some metadata. They are aware of this, doesn't seem to be any limitation preventing them from fixing it, and it has sat unfixed for years. Microsoft's cloud storage as a whole is an insane tangle where you never know…

How large are the files?

Kilobytes or single digit megabytes. It happens because Sharepoint sporadically alters created/edited metadata for any (?) file it stores. Most programs don't care about that but Solidworks does.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#78

As usual with all these types of posts, people go "HA HA, MICRO$OFT SUCKS" without understanding business practices that keep them afloat. Don't use Exchange? Cool, what should we use instead? Does it support 15 people all the way up to 150000 people? I used to run Exchange cluster for 70k people, is there other mail software out there complete with non-shared disk redundancy? Where the users connect to single endpoi…

I mean this is nuclear wepons were talking about, who cares about features vs security? They could run the department on snail mail if they tried

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#79
post #54

Earlier quoted context omitted.

Ah yes, " likely air-gapped", what a high-confidence statement. Any competently designed air-gap must be precisely auditable and demonstrably, positively air-gapped. The only world where "likely" is a reasonable word is in reference to possible physical taps or a precise enumeration of physical access points that went unaudited, but have reliably followed safe access control/configuration procedures. Anything else is…

How do you go about positively demonstrating such a system is air-gapped?

Speaking from past experience with the DoE (I'm happy I don't need to deal with security like this anymore), there were constant and randomized checks to make sure fiber cables (they were all fiber to make it harder to tamper with and to avoid accidental RF) were fully visible (e.g. not hidden under a desk or something) and not tampered with. Also, lots of locks and doors, both electrical and mechanical. The guy at the front desk with a big gun probably helped too.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#80
post #5

There needs to be a law that all nuclear and nuclear-adjacent facilities have no connection to the Internet. The fact it's allowed is unbelievable.

While we're at it "and not use Microsoft products". Literally every time a story like this surfaces...

I don't think any Microsoft Surfaces were involved in this..
Post reply on HN